CVE-2026-45321CRITICAL 9.6CISA KEVEPSS p72.6%
CVE-2026-45321TanStack Unspecified Vulnerability
TanStack / TanStack
Description
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.
Scoring
| CVSS 3.1 | 9.6 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| EPSS | 1.60% probability of exploitation · percentile 72.6% · 2026-06-19T12:03:05Z |
| Published | 2026-05-12 |
| Last modified | 2026-05-14 |
CISA KEV entry
Added to KEV: 2026-05-27
Underlying weaknesses· 1
References
- https://github.com/TanStack/router/issues/7383
- https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx
- https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
- https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem
1
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Embedded Malicious Codecwe-506 | 0% | live |
(incoming)1
| Type | Target | Confidence | Tier |
|---|---|---|---|
| KEVEntry | TanStack Unspecified Vulnerabilitykev-cve-2026-45321 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.